FIX: app.http.require.roles
DEV: add support for app.http.auth.type == none
FIX: app.http.resources.singletons
FIX: Return 403 for unauthorized access - not 401
DEV: strengthen testing URIs on input.