auth interfaces

phase 1 should only support RFC 2617 security schemes