Fix for #1652 - Make Authorization Filters run first

This change moves authorization filters to be the first filter stage
(before exception filters).
:+1: yep. That's used in general here because we're expecting the initialization to come from elsewhere, I just missed this one.