Authenticates a request to a protected endpoint and decides whether it
holds the scope the operation needs.
It tries OAuth, then GNAP, then Basic. It sends nothing itself: the
decision carries ok, status, err, description, headers (the
challenges on a 401), principal, scheme, scopes and, on a refusal,
the error code, and the route writes the body.
Authenticates a request to a protected endpoint and decides whether it holds the scope the operation needs.
It tries OAuth, then GNAP, then Basic. It sends nothing itself: the decision carries
ok,status,err,description,headers(the challenges on a 401),principal,scheme,scopesand, on a refusal, the error code, and the route writes the body.