Moved client-side authorization logic into factory.