Authentication

Do not construct authentication policy inside a login helper

Keep login, logout, eligibility, credential upgrades, and HTTP permission checks behind the authentication services configured by your application.