Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
I think the caching layer should be hidden behind the Authorizer interface. It's an implementation detail.