Why Authorization before Authentication?

[Edgar Fuß]

> My recommendation to anybody who asks this question [...],
> is to think of authorisation being separate from generating the reply.
Do I understand you correctly in that you only recommend to /think/ that way, not that it's actually /done/ that way? As I understand it, crucial parts of the reply are set up in the users file, which is called by the file module in the authorize section.