New authorization system

will be squash, clean and rebased later when it's ready