Don't you need to pass in the current principal in order to resolve authorizations?