Authentication of resources.

There are lots of obvious security caveats here, but this is working
towards having them not be the concern of the handlers themselves.