Factorize most of authentication out of Application*
Move header logic to a HeaderController