Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
To clarify, lavalamp and I were in agreement, as long as there is no case where the person making the authorizer call is explicitly looking to bypass caching.  However, it seems like that caller would want to expose that desire to the person who instantiates him, and so would probably clarify that as part of his instantiation ("I don't want cached authorization").