eliminate authorization-list from resource as its implementation is, for now, reserved to the application ad otherwise to b factored into a distinct class