Which component should you place between Cloud Load Balancing and a PHP Application to build a public API that handles authentication, enforces quotas, and reports metrics for API callers?