Authentication and authorization patterns in SvelteKit: session IDs (revocable, DB-dependent) vs JWT (non-revocable, faster); implement via server hooks and locals; use Lucia for session-based auth.