In future, when we move to a ProtocolServer for REST (using the Netty <> Resteasy bridge) I want to handle security in only one way