Request authentication and authorisation

[zefir-git]

Authenticators are registered on the Server. When auth is necessary, routes can call the auth methods on the Request, which will then perform auth with the registered Authenticators on the Server.

The Authorisation class holds Permissions. Permissions can be used as API scopes. It can also hold additional data, e.g. user id/object, etc., which is fully typed and customisable.

The Server class picks up the Authorisation additional data type from the configured Authenticators. This type is then passed onto requests, responses, etc., thus retaining the correct type for the data.