do not pass user into authorization callback
spell out decision variable's name
use decision store so that auth block doesn't necessarily have to return a Decision