Authentication is enforced server-side.