Started on authentication then got sidetracked
Move header setting into response.
Refactored to a poor man's CoR
Break up chain of responsibility into constituent classes.
Tidying up AuthorizationDetails