Add default authentication and authorization libraries.
Wire up a simple forbidden response for merges.