Implementing an authentication scheme in ASP.NET