Fix for #1652 - Make Authorization Filters run first

This change moves authorization filters to be the first filter stage
(before exception filters).
the way to do it would be to throw :laughing:. That's not part of this PR though