Simplified lib/protected-resource-handler.js

- use async.waterfall
- added tests for some failure conditions