How does Drupal handle user authentication and authorization?