How does custom authentication work?