[connection] redo readonly impl

Safest impl for read-only is to use an authorizer callback.