Authentication

Logging -- to console or to file:
Provide control over the amount to be logged. The default should be no console output.
If logging to file, take steps to avoid producing an arbitrarily large amount of output -- for example, swap to a new log file every 24 hours and only keep the last few log files. Or could swap when the size exceeds a certain limit.

Add 401 error