Microsoft 365 for the web does not do any authentication, except as part of the business user edit flow. Hosts are expected to handle authentication and authorization by providing WOPI access tokens. All user-related information is provided to Microsoft 365 for the web by the host using properties in CheckFileInfo.