o.c.sec: AuthorizationProvider via OSGi service, not extension point