Better auth story

From the security review bug (https://github.com/postmates/cernan/issues/461):
> None of the sources auth, the few sinks that have auth credentials are, iirc, not wired up to authenticate. IP whitelisting and/or presence in a blessed subnet was Good Enough. Obvious issues there.