authorization in mojoPortal depends on authentication which produces a cookie so that it does not have to happen on every request, the cookie is the token that identifies the user across multiple requests
there is nothing built in to mojoPortal to do it another way, trying to work around that would most likely just result in security holes