Authorization logic: why it's hard | Dark Hacker News