Authentication isn't reentrant?