Moar authorization attributes

Based on PR #2117.

Future PRs will
  - refactor the growing code duplication in `test/integration/auth_test.go`.
  - replace injected Authorizer with a new authorization mode and acl file.
  - improve documentation.
 

Breaking up improves unit testing.  But, it harms testing the integration of the broken up components.  Maybe what I am saying is I wish e2e wasn't so big and slow.  But e2e tests are always that way.

I'll work on a PR to inject the Authorizer and revist the e2e test thing later.