the naming tension here probably means the client should hold just the authorizations and not the request... perhaps `Expiry` moves over to the `Authorization` struct