Fix a minor bug with Authorization

If a rule doesn't exist, Policy.evaluate() attempts to short-circuit by
building an Authorization, but it doesn't pass anything to the defaults
argument.  This fixes the problem by making the call legal: defaults
now defaults to the empty dictionary.
Add some basic functional tests

This adds some basic functional tests that verify that authorization
evaluation works properly.