Main authorization endpoint. Default (and only) real authorizer keeps a mapping resource -> permission sets in system table