What is the difference between 'authentication' and 'authorization' in web application security?

• A.Authentication and authorization are synonymous; the terms are used interchangeably in security documentation
• B.Authentication uses cookies; authorization uses HTTP headers - that is the technical distinction
• C.Authorization is client-side identity verification; authentication is server-side permission checking
• D.Authentication verifies identity - 'Who are you?' (proving you are who you claim: username+password, biometrics, certificates). Authorization verifies permissions - 'What are you allowed to do?' (verifying an authenticated identity has access to a specific resource or action). Authentication always precedes authorization, but passing authentication does not imply any particular authorization