Update AuthorizationService.php

My initial PR was messed up, the four cases i outline at #136 never would have worked. The assertions should ONLY return true and nothing else. If the assertion is wrong, the permission can still be there.