better authorization - authz methods can return null when they dont want to take part in authz chain
extensible integration test of manager audit and authorization