Break client auth

Add ProtectedResourceHandler. Add AuthorizationHandler.