Agent authorization is broken — and authentication passing makes it worse