SEC-2202: http.authorizeUrls() to http.authorizeRequests()

This change is more meaningful since the requests can be matched on
anything not just the URL