Authorization is now centralized to App::authorize()