new HLet hierarchy for async/sync requests

This is not perfect yet, and code is duplicated. Actually, we should
investigate on how to make the authentication feature stackable and how
to make it not impact the existing lets. Moreover, currently the
authentication is basic but when we will support OAuth in addition to
cookie based authentication the authentication logic will become a bit
more complicated (or not?). Let's see if this scales and is usable at
all.