Isn't the *RequestAuthenticator* interface a new class? If so, we can add it to the API module.

The implementing classes can stay in IMPL. (maybe I'm missing something)