AuthorizationService and Clock are injected but never used.