Authorization logic: why it's hard | Hacker News Reader