In which phase of the access control does a user need to prove his or her identity?