Class ServerAuthenticator

The authenticator over the server's users: Authorization: Basic with a user name and a clear-text or hashed password, checked by UserAuthentication.

The plain-http policy (WIRE-CONTRACT §7.5, an open ruling). The client sends no credentials over plain http, localhost included, yet permits every authenticated operation there; the acceptance test runs exactly that way. Until ruled, this authenticator accepts an unauthenticated request only when all of the following hold: the server runs in development mode, the connection is not secure, and the remote address is the loopback interface. Such a request acts as the predefined "iiziRun Developer" user - the client's own default - and the first one is logged. Everything else without credentials is 401. In production mode nothing is implied.

Who may push. /iizi-push/push is the test tool's send; it is permitted in development mode to any authenticated user and refused (403) in production mode, where sends belong to the admin API of a later order. Also an open ruling.