Update authorization best practices

[Amruta-Ranade]

Source: Raphael on Slack:

• at the end of the first, "create users or roles with specific privileges based..."
• remove the second bullet entirely
• keep the 3rd as-is