Added the request path to the context-aware logging.  Finally sorted out authorization - lots of finagling and wrapping.