Authorization has always been the primary question; authentication is simply an ancillary question to help answer it.