All requests from the client should be authenticated, even after the initial establishment of a connection. Simply authenticating the initial request followed by using the source IP/port to extend trust to subsequent requests is not a sufficient basis for trust.