const session = await
auth.verify(credentials)
  .then(user => user.grant())
  .catch(err => deny());

// secure · encrypted · monitored