When prototyping I often start this way (client-datastore) but the first thing that forces me to add a middle tier is authentication\authorization or protecting

When prototyping I often start this way (client-datastore) but the first thing that forces me to add a middle tier is authentication\authorization or protecting the API for any reason.