Yes, authentication is done by the server and does not involve the document at all. But authorization does. If you want something other than full-access versus no access then you will have to use section access and that will require reloading the document when authorizations change.