Some changes to authentication. Checks for X-SOURL.