Wondering if we should follow the main code base convention of splititng out authorization related functionality into a module.