Loading default AuthorizationsProvider outside SPI process

Ah...  you got me.  I'm coming up empty on anything better than string concatenation.  

Building up a string is probably not a performance concern given the *exceptional* use case here...