authentication and authorization inspired by Apache Shiro