https://www.securityprivacyrisk.com/2016-reality-lazy-authentication-still-the-norm/