Caddy module to require at-proto authentication and restrict routes to DIDs