code: func (a *AuthWithRoles) AuthenticateWebUser(req AuthenticateUserRequest) (services.WebSession, error) {
  	// authentication request has it's own authentication, however this limits the requests
  	// types to proxies to make it harder to break
  	if !a.hasBuiltinRole(string(teleport.RoleProxy)) {
  		return nil, trace.AccessDenied("this request can be only executed by a proxy")
  	}
  	return a.authServer.AuthenticateWebUser(req)
  }
docs: // AuthenticateWebUser authenticates web user, creates and  returns web session
  // in case if authentication is successful