authenticateRequest takes a resources argument now