Describe the solution you'd like
Since plugins tend to implement REST controllers to improve accessibility of functions that are already available as commands, we should provide some similar basics here too.
One of those basics would be user Authentication (As in: Does this request originate from a specific user and - if so - from who is it?) and Authorization (As is: Is the actor allowed to peform this action?)

Describe why you would like to see this implemented
As desirable as a full-blown authentication & authorization mechanism would be, we should start somewhere more basic.
The basic needs are defined by these statements:

• A request can be associated with a IUser (or at least ISubject). [Authentication]
• A request mapping can be gated with a permission forcing it to be only available to subject authenticated requests. [Authorization]
• The associated optional association must be provided to endpoints in some way.
• The Authorization header should be used for this and we should start with the non-standard Token authorization scheme. (Simple IUser -> IAuthenticationToken association)