- Rename Security folder -> Authentication - Change Authenticate to only take one scheme to match other APIs, the params overload did not make it any cleaner to consume (since it didn't produce a combined ClaimsPrincipal anyways)