Authentication should be supported as a mutation

You are currently either logged in or you're not. Some of the fancier bugs can be found by running requests that are not authenticated or use the wrong user.

Maybe you can specify using a flag, which status codes are acceptable when unauthenticated?

This is a research issue first, code issue second.