Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
I was imagining something like:

```go
type authzDecisionWithTTL struct {
  bool isAuthorized
  int64 expiresTimestamp
}
// CachingAuthorizer implements Authorizer interface, and adds caching to any Authorizer.
type CachingAuthorizer struct {
  authzImpl Authorizer
  cache map[Attributes]authDecisionWithTTL
}
func (c *CachingAuthorizer) Authorize(a Attributes) { ... }
```

which seems compatible with lavalamp's preferences.