Authentication based on the session (when the user is already logged on the site) or authentication via HTTP only (with request.authorization).