How is user authentication carried out?