Understanding serverless application authentication and authorization