CDAP-658 common-authorization: authorization service and client

This doesn't seem to have any authentication or authorization itself, so how does it support any authorization enforcement?  What stops a client from setting whatever ACLs they want?  How do we do mutual authentication so that we know we can actually trust the ACLs returned to the client?