The distinction was already present in Apache2 configs in early 2000's, although there authentication was "auth", and "authorisation" was authz. Real travesty

The distinction was already present in Apache2 configs in early 2000's, although there authentication was "auth", and "authorisation" was authz. Real travesty came from OAuth. A system designed to handle authorisation was named after the term for authentication.