ApiKeyAuthentication If the request has an authorization header, we will try to pull the service account who owns it from the database and put the account into the context.

IAPAuthentication authenticates a request using IAP headers.

Oauth2Authentication If the request has a session cookie, look up the session from the store, and if it exists, try to load the user with the email address stored in the session.