Refactor authn checking.
Implement an external authz checking example.
Just check authn, and let the service do its own authz.