Sure, though I think this is somewhat specific to serverless because in traditional applications, authentication usually covers all interactions with the user w

Sure, though I think this is somewhat specific to serverless because in traditional applications, authentication usually covers all interactions with the user whereas with serverless you sometimes have to figure it out on a case-by-case basis. The article makes it sound like it accounts for it with CORS headers, which may mislead novices.