Let's not have a bunch of authorization boilerplate on every RPC from the client.

Includes pull request #41; we should merge that first.