Reusable wcf authorization.

Standard authorization policy is usualy tweaked just a little.
Mark critical part of it as virtual, so it can be reused in other projects.