internal/v4: macaroon-based authorization