separate the authentication from authorization & add principal type to differentiate users from customers