CE-to-CE Authentication for Layer 3 VPNs