Move some request security checks to Fetch so other APIs can do the same.