Use normalized case.
We should be optimizing authn and authz in the same request, where supported.
Reformat.
Add support for the authz API.
Continue fleshing out hooking up authz.
Add first-round checking of authz.  Support minor
changes to the authn API.
Turn on authz checking.