ONLY handles authentication -- it doesn't handle authorization at all.
ONLY handles authentication -- it doesn't handle authorization at all.