Basic server-side, session-less auth.