AUTHENTICATION: no check of identity of client

[soumyaray]

There is no checking of credentials of client user. We need to authenticate their identity prior to accepting resource requests.