Split authorization from task validation.

Review: https://reviews.apache.org/r/26817