A reverse-proxy auth plugin is not application authorization

Quick check: call the same handler with a valid token for user A and a resource id belonging to user...