sub authenticate {
    my ($self, $session) = @_;
    ...