Authorization checks and metrics now operate by calling lastb