X_UNAUTHENTICATED
Means
no authenticated actor for this request
Typical cause
the two things that produce an anonymous actor where one is needed: the request carried no __Host-x_session cookie, or it carried one nothing resolved. authenticate() answers the anonymous actor for a missing cookie rather than throwing, which is why the failure surfaces one layer later, at the surface that needed the actor. Also the code for an oauth identity a local account already holds — @ultimat3/auth owns it, @ultimat3/http only borrows it
Fix
send the __Host-x_session cookie with this request, and resolve it once at the boundary: authenticate(auth, readSessionCookie(request, auth.sessions.policy))