Implementing authentication for web services