+ routing: add `optionalAuthenticate` directive

- `optionalAuthenticate` directive provides `Some(userContext)` on
success, `None` if no credentials are provided, otherwise rejects