There's a layer (written in Clojure) between the client and CouchDB which does authentication, permissions, etc.