Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Maybe: ```Authorize(a Attributes) (bool, error)```