Allow different authentication methods (including not using any authentication)

We want to be able to authenticate a client using any custom `Authentication` HTTP header.
We also support APIs not using any authentication method.