I think EVENT_ROUTE is a great event, we don't need to dispatch to authorize/unauthorize access. However, I think that if we need soemday to add a support to authorize/unauthroized by route, we should make sure that the route is matched. Therefore we should lower the priority.

According to the doc (http://zf2.readthedocs.org/en/latest/modules/zend.mvc.mvc-event.html#mvcevent-event-route), route matching is at priority 1, so maybe we should register this listener at -10.