Add default Authorize() implementation and allow asynchronous reply