Fix for #1650 - Make Authorization Filters run first

This change moves authorization filters to be the first filter stage
(before exception filters).
will revert. Sorry wanted to get eyes on this before leaving for lunch.