Authorization logic: why it's hard
osohq.com