Add access_token/authenticateCredential support to authentication.session
authenticateRequest takes a resources argument now