Moar authorization attributes

Based on PR #2117.

Future PRs will
  - refactor the growing code duplication in `test/integration/auth_test.go`.
  - replace injected Authorizer with a new authorization mode and acl file.
  - improve documentation.
 

parts[0] is fragile to other assumptions (that the API is rooted at `api`, which it isn't guaranteed to be).

This function feels like it should be in its own method.