pass arbitrary arguments to #authorize

this facilitates the usecase where an query method would want to
conditionally authorize based on the content of the request parameters