anchor.diff:  
   procedure TMARSActivationRecord.CheckAuthentication;
   begin
  -  if Token.IsVerified and Token.IsExpired then
  +  if FAuthorizationInfo.NeedsAuthentication then
     begin
  -    Token.Clear;
  -    Token.UpdateCookie;
  -    raise EMARSAuthenticationException.Create('Token expired', 403);
  +    if Token.IsVerified and Token.IsExpired then
  +    begin
  +      Token.Clear;
  +      Token.UpdateCookie;
  +      raise EMARSAuthenticationException.Create('Token expired', 403);
  +    end;
     end;
   end;
   
   procedure TMARSActivationRecord.CheckAuthorization;
  -var
  -  LDenyAll, LPermitAll: Boolean;
  -  LAllowedRoles: TStringList;
  -  LProcessAuthorizationAttribute: TProc<AuthorizationAttribute>;
  -begin
  -  LDenyAll := False;
  -  LPermitAll := False;
  -  LAllowedRoles := TStringList.Create;
  -  try
  -    LAllowedRoles.Sorted := True;
  -    LAllowedRoles.Duplicates := TDuplicates.dupIgnore;
  -
  -    LProcessAuthorizationAttribute :=
  -      procedure (AAttribute: AuthorizationAttribute)
  -      begin
  -        if AAttribute is DenyAllAttribute then
  -          LDenyAll := True
  -        else if AAttribute is PermitAllAttribute then
  -          LPermitAll := True
  -        else if AAttribute is RolesAllowedAttribute then
  -          LAllowedRoles.AddStrings(RolesAllowedAttribute(AAttribute).Roles);
  -      end;
  -
  -    FMethod.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
  -    FResource.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
  -
  -    if LDenyAll // DenyAll (stronger than PermitAll and Roles-based authorization)
  +begin
  +  if FAuthorizationInfo.NeedsAuthorization then
  +    if FAuthorizationInfo.DenyAll // DenyAll (stronger than PermitAll and Roles-based authorization)
          or (
  -         not LPermitAll  // PermitAll (stronger than Role-based authorization)
  -         and ((LAllowedRoles.Count > 0) and (not Token.HasRole(LAllowedRoles)))
  +         not FAuthorizationInfo.PermitAll  // PermitAll (stronger than Role-based authorization)
  +         and ((Length(FAuthorizationInfo.AllowedRoles) > 0) and (not Token.HasRole(FAuthorizationInfo.AllowedRoles)))
          ) then
         raise EMARSAuthorizationException.Create('Forbidden', 403);
  -  finally
  -    LAllowedRoles.Free;
  -  end;
   end;
   
   procedure TMARSActivationRecord.CheckMethod;
  
positive.code: begin
    CheckResource;
    CheckMethod;
    CheckAuthentication;
    CheckAuthorization;
  end;
  
  class procedure TMARSActivationRecord.RegisterAfterInvoke(
  
negative.code:     FWriter: IMessageBodyWriter;
      FWriterMediaType: TMediaType;
      FInvocationTime: TStopWatch;
      FAuthorizationInfo: TMARSAuthorizationInfo;
  
      procedure FreeContext; virtual;
      procedure CleanupGarbage(const AValue: TValue); virtual;
  