Risk identification to optimize authentication