Seriously flesh out the AuthorizationManager and the test webapp.