Move authorization info to the annotation directive.

This way the auth('delete') and auth('update) is calculated only once per annotation