Add a Request-Id header for tracking across the front and back ends.
Return 401 for unauthorized and 403 for authed but forbidden.