Support additional authentication types besides just basic authentication and support authorization of resources. This means we'll be able to support people logging in via BasicAuth, DB, LDAP, OAuth, SAML, etc. We can also annotate resources as requiring a certain permission or role. And we can know who the logged in user is to log which user takes certain actions or to show who the logged in user is at the top of the webapp.