Authc filter should allow schemes to tell if a resource is protected or not.