CallerResolver

Who sends a request to the public port: the edge authenticates, admission authorizes.

A resolver reads the request's credentials, and answers null when it accepts none: the request is answered 401 wow.auth.unauthenticated. It also decides the space of a request that names one (Wow-Space): the caller it returns acts in that space when the principal belongs to it; a caller whose space is not the one the request named is answered 403 wow.auth.forbidden, never served in another space.