Currently we support MTLS and BASIC auth as the two ways to secure the connection between the API Gateway and the back end API. This prevents clients from bypassing the gateway.

We should examine what other authentication mechanisms make sense, perhaps including:

1. OAuth
2. Digest
3. Others??