Allow framework-handled authorization

Allow a framework to override authorize specifically, falling back to using the framework's authenticate if an authorize-specific override is not needed.