[Authorize] attribute

Also written: Authorize, AllowAnonymous

The controller-style way to require a signed-in caller, optionally with `Roles = "staff"`. `[AllowAnonymous]` opens one action to everyone again.