Pluggable authorization, see #47