How authentication should work (in my mind)