Support multiple id values in controller action authorization

Minimized the upstream differences that were in request #38