docs: async function authorize (action, target) {
      let result = await check(this.auth.credentials && this.auth.credentials.user, action, target)
      if (result !== true) throw Boom.unauthorized(action)
      return true
    }