On the Design and Testing of Authorization Systems