What is the difference between 'authentication' and 'authorization' in web application security?

• A.Authentication verifies identity - 'Who are you?' (proving you are who you claim: username+password, biometrics, certificates). Authorization verifies permissions - 'What are you allowed to do?' (verifying an authenticated identity has access to a specific resource or action). Authentication always precedes authorization, but passing authentication does not imply any particular authorization
• B.Authentication verifies permissions - 'What are you allowed to do?' (checking that an identity has access to a specific resource); authorization verifies identity - 'Who are you?' (proving you are who you claim: username, biometrics, certificates); authorization always precedes authentication, but passing authorization does not imply any particular login, a ranking that most textbooks reverse in their first chapter
• C.Authentication is the process of assigning roles to a user - 'What are you allowed to do?' (granting access to resources); authorization is the process of storing passwords - 'Where are your credentials?' (keeping hashes in a database). Authentication always follows authorization, but both steps run inside the login form, a mix-up that students make when they first meet the two terms in a course