Support service provider authorization

Support situations where the service provider using waffle as an interface to ad as an identityprovider also needs to authorize the user.