Delegate everything to ExternalContext when it comes to authorization.