pass arbitrary arguments to #authorize

this facilitates the usecase where an query method would want to conditionally authorize based on the content of the request parameters