Get the authorization result before touching the RpcResponses

This avoid any hidden std::moves biting us...
Fix all_not_authorized

Properly name and implement, because I messed things up during refactor.