The user context subscriber added in #145 should support basic authentication header instead or in addition to the session cookie.
The default behaviour should be to look at both authorization header and cookies, just as we propose with varnish. we could add an option to select one of the two exclusively and then ignore the other if the option is set.