Moved authentication code to the header, so it can't be easily bypassed (header is loaded everywhere).