Introduce domain as a component of the HMAC signature for signed authentication cookies. This is important to prevent re-use of a cookie across domains which might be co-hosted (Eg for multi-tenanted applications) but which might have different authentication requirements.
return 401 or 403 depending on authentication/authorisation failure
allow non annotations principals to be used in ACL