I read at about gathering requirements but still fail in deciding some requirement as FR or NFR

some requirements are close to be both for example

the system shall require user authentication before access

it is about the login case so it can be functional

it us about security so it can be non functional

so I am abit confused can any one explain the difference