Authentication and authorization solve different problems

Authentication answers who is making a request; authorization checks what that identity may do. Keep the checks separate: a valid identity doesn't automatically have permission to read or change every resource.