anchor.diff:  
       procedure CheckResource; virtual;
       procedure CheckMethod; virtual;
  +    procedure ReadAuthorizationInfo; virtual;
       procedure CheckAuthentication; virtual;
       procedure CheckAuthorization; virtual;
     public
  
positive.code: 
  procedure TMARSActivationRecord.CheckAuthentication;
  begin
    if Token.IsVerified and Token.IsExpired then
    begin
      Token.Clear;
      Token.UpdateCookie;
      raise EMARSAuthenticationException.Create('Token expired', 403);
    end;
  end;
  
  procedure TMARSActivationRecord.CheckAuthorization;
  var
    LDenyAll, LPermitAll: Boolean;
    LAllowedRoles: TStringList;
    LProcessAuthorizationAttribute: TProc<AuthorizationAttribute>;
  begin
    LDenyAll := False;
    LPermitAll := False;
    LAllowedRoles := TStringList.Create;
    try
      LAllowedRoles.Sorted := True;
      LAllowedRoles.Duplicates := TDuplicates.dupIgnore;
  
      LProcessAuthorizationAttribute :=
        procedure (AAttribute: AuthorizationAttribute)
        begin
          if AAttribute is DenyAllAttribute then
            LDenyAll := True
          else if AAttribute is PermitAllAttribute then
            LPermitAll := True
          else if AAttribute is RolesAllowedAttribute then
            LAllowedRoles.AddStrings(RolesAllowedAttribute(AAttribute).Roles);
        end;
  
      FMethod.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
      FResource.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
  
      if LDenyAll // DenyAll (stronger than PermitAll and Roles-based authorization)
         or (
           not LPermitAll  // PermitAll (stronger than Role-based authorization)
           and ((LAllowedRoles.Count > 0) and (not Token.HasRole(LAllowedRoles)))
         ) then
        raise EMARSAuthorizationException.Create('Forbidden', 403);
    finally
      LAllowedRoles.Free;
    end;
  end;
  
  procedure TMARSActivationRecord.CheckMethod;
  
negative.code: begin
    CheckResource;
    CheckMethod;
    ReadAuthorizationInfo;
    CheckAuthentication;
    CheckAuthorization;
  end;
  
  procedure TMARSActivationRecord.ReadAuthorizationInfo;
  var
    LProcessAuthorizationAttribute: TProc<AuthorizationAttribute>;
    LAllowedRoles: TStringList;
  begin
    FAuthorizationInfo := TMARSAuthorizationInfo.Create(False, False, []);
    LAllowedRoles := TStringList.Create;
    try
      LAllowedRoles.Sorted := True;
      LAllowedRoles.Duplicates := TDuplicates.dupIgnore;
  
      LProcessAuthorizationAttribute :=
        procedure (AAttribute: AuthorizationAttribute)
        begin
          if AAttribute is DenyAllAttribute then
            FAuthorizationInfo.DenyAll := True
          else if AAttribute is PermitAllAttribute then
            FAuthorizationInfo.PermitAll := True
          else if AAttribute is RolesAllowedAttribute then
            LAllowedRoles.AddStrings(RolesAllowedAttribute(AAttribute).Roles);
        end;
  
      FMethod.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
      FResource.ForEachAttribute<AuthorizationAttribute>(LProcessAuthorizationAttribute);
  
      FAuthorizationInfo.AllowedRoles := LAllowedRoles.ToStringArray;
    finally
      LAllowedRoles.Free;
    end;
  end;
  
  class procedure TMARSActivationRecord.RegisterAfterInvoke(
  