KAZOO-1539: started refactoring authz to support federation