refactor permissions.authorize to use ids and not principal objects