Add authentication to master endpoints

Before we can add authorization around operator endpoints, we need to add authentication support, so that unauthenticated requests are denied when --authenticate_http is enabled, and so that the principal is passed into `route()`.