3.7.1 Authentication and Authorization