Respond to initial Authentication and Authorization questions from AppSec review

This issue tracks the completion of a response to this question on the AppSec review: https://gitlab.com/gitlab-com/gl-security/appsec/appsec-reviews/-/issues/201#note_1372739808

Requested a response from @vtak and @shekharpatnaik on the original issue: https://gitlab.com/gitlab-com/gl-security/appsec/appsec-reviews/-/issues/201#note_1373492964