Servant (the typed routing system being used here) has pretty awesome and robust authentication support. I bet it could be added without too many additional lines.