Is that allowed? Authentication and authorization in Model Context Protocol