Implementing authentication and authorization control