Authentication for third-party applications