Here are my points which I have to think more about.

1. API changes in Authorize. I'd love to avoid it.
2. Losing the context (Client) in Authorize.
3. The Mutext, which is just needed for concurrency.

Originally posted by @chripo in #36 (comment)