extract authorizing logic from handler into request