>Before it checked all unique scope names up front - to avoid rechecking the same scope lots of times if they were all the same.

It still does that. It builds up the unique scopes in 'scopes' (checks unique as it did before via UniqueScopes), then gets authority on all of them via secmgr->authorizeEx.

It calls checkWuScopeListSecAccess individually as it iterates, but as I was saying, that isn't actually authenticating, it is merely checking the flags locally, that were retrieved by the remote authorizeEx call.