support new HMAC authentication for accessing restricted items. it's now the default authentication provider. old user/sig cookie auth may still be used by setting .auth-type parameter to 'user'