Maybe this stems from newbie developers thinking that authentication == authorization