Folders follow up

Initial follow-up, still some pending
We sort of settled on a format where authz-related logic goes into `lib/authz`.