minor: naming; this doesn't actually do authorization, just authentication