Session and token authentication.