Is it just me, or do I not get the spirit of HTTPAuthSessionWrapper. Why does it have a render method? This is a wrapper, shouldn't it be calling the render of the avatar that it's fetching, not itself? Why isn't it just a mixin that can enforce HTTP auth for any arbitrary resource?