in reply to CGI::Prototype - let me clarify the response phase for you
authenticate -- establish identity
authorize -- does identity have sufficient rights for requested action.