Secure backstage endpoints based on authenticated identity

[cowboyd]

We currently do not have any role assignment to various endpoints and so they are all unprotected. We need to not only a strategy for securing endpoints, but also a decision tree for which routes should be protected and which should be public. Including a policy when no decision has been made.

[jbolda]

#185 is in some way the beginning of implementing this. It seems that we would want an auth middleware to take it all of the way. There appears to be some community docs in the vein.