Function prove 

pub(crate) async fn prove(
    state: &AppState,
    headers: &HeaderMap,
    lxm: &str,
    allow_anonymous: bool,
    named: Named<'_>,
) -> Result<Proof, ApiError>

Resolves the Authorization header on a tree route into what it proves.

A session token this server issued is the account it names. A JWT is told apart by its iss: a DID is a key proof for lxm, a URL an OpenID Connect token. No header at all is the deployment itself, and only where AppState::unauthenticated_creates says so.

named is the account the request says the credential is for. An ID token is checked against that account’s identities alone, so it needs one; a session or a key proof names its own account, which must be the one named when the request names one. Both refusals come before anything is fetched or spent.