Package name, an optional string. The associated package will
generally by implied by the namespace within which the AuthState is
defined. But it's possible to record the package name explicitly and
seems like a good practice.
API key (a string). Necessary in order to make unauthorized
"token-free" requests for public resources. Can be NULL if all requests
will be authorized, i.e. they will include a token.
auth_active
Logical. TRUE means requests should include a token (and
probably not an API key). FALSE means requests should include an API key
(and probably not a token).