scoped auth tokens (like cookie domain/path)

[endel]

It should be possible to have different users authenticated on multiple locations at once, such as "/", and "/admin".