Fix for #1652 - Make Authorization Filters run first

This change moves authorization filters to be the first filter stage
(before exception filters).
would `Debug.Assert(_exceptionContext != null);` be useful above this line?  consistent w/ new line 55.