no asserts in http methods.
fix indentation.
include tracing in list of request middleware.

todo: it would be nice to specify request AND/OR response in the block where the middlewares are declared.  That way we won't run into this kind of problem (TIMTOWTDI).
* Fix a bug in the way headers are checked for.
* Make sure to authenticate.