Making progress on the auth component.  We can ensure that requests to /protected must be authenticated first