#3: Authorization in the HTTP component