Corrected a mistake.
Book said that for authorization of downloads one has to set the "authorization" attribute for the corresponding field. However, looking into the source code (dal.py, line 9852), the attribute that is actually checked is called "authorize" instead.