idea for a DB based authorization model