Tidying up coordination of authorization layer

Instead of relying on two external flags for authorization
configuration, I'm preferring a singular flag. It is likely that I
should extract an AuthorizationLayer.build method.

There is also a bit of tidying up of specs to better convey intent and
reasoning.