DEV: strengthen URI parsing and add unit test
FIX: Authentication configuration

- app.http.require.roles
- app.http.auth.type == 'none'
- app.http.routes.resources.singletons
- Return 403 for unauthorized access.