If you solve authentication separately from authorization, this is what happens