More work on having authorization driven by positions
Yet more authorization
Separate out authorization for the admin console