What is your experience with implementing authorization and authentication on the frontend: tokens, sessions, OAuth, two-factor authentication, role-based model?