Authenticaion: whot can? who can't?