Split authorization / authentication