Building authentication and authorization in web apps - things to remember