If we open the authentication up to user or consumer, then we are letting users perform some actions that only a consumer should try and perform on itself such as consumer_checkin which seems strange. My proposed solution is to add

```
  def authorize_proxy_routes
      deny_access if !(authenticate || authenticate_client)
```

And call this method only for the 4 proxy actions.