Allow finer grained authorization

[darioteixeira]

Presently, RIP accepts the definition of an authorize function per service. This is not granular enough, as some services may allow public access to read-only methods like GET while requiring the enforcement of stricter authorization for methods like POST or PUT.

We should keep the service-wide authorize function as fallback, but allow also the definition of custom authorization functions for particular methods.