Should AuthorizationManager.authorize prohibit null

[rwinch]

Given that we have a rich object being returned here, I wonder if we should prohibit a null value from being returned

For the Reactive side, I wonder if we should prevent an empty Mono from being returned