update authentication.{inbound,outbound}

authentication.inbound -> .read_auth_from_headers
authentication.outbound -> .add_auth_to_headers

And the latter no longer requires a request object.