Secure authentication and authorization in SaaS