Finish AuthN, Start AuthZ, Add friendly-forwarding