Moar authorization attributes

Based on PR #2117.

Future PRs will
  - refactor the growing code duplication in `test/integration/auth_test.go`.
  - replace injected Authorizer with a new authorization mode and acl file.
  - improve documentation.
 

Go convention is not to use underscores here if possible - `authhandlers` is more consistent (or at least, based on what I've seen).