i've got a TODO to write up a blog post around this, because it seems like a centralized authorization service is the first time that many folks run into this problem, and all of the solutions leave something to be desired :/