Split authentication from authorization.