Add support for request level authentication.

The current principal can be stored at a request level
to avoid allocating a session.  This is useful when coupled
with token based authentication.