Require a logged in user to resolve an authorization request

[ajgarlag]

Introduces BC breaks

Fix #195

[ajgarlag]

@chalasr Can your review this? Thanks!

[chalasr]

Thanks 👍 Let's merge for now and reconsider in case the BC break appears to be too annoying.

[chalasr]

Thank you @ajgarlag.

[ajgarlag]

@ajgarlag ref #200 :) im wondering if the runtimeexception is reasonable

I was unsure too. Do you think a logicexception is more reasonable here?

[ro0NL]

@ajgarlag figured the config is required

i was more thinking about throwing UnauthorizedHttpException to avoid the 500 response

but then the issue may not be noticed in logs 🤔

[ajgarlag]

IMO the UnauthorizedHttpException is not a good option.

Since 0.9.0 a logged-in user is required to authorize the request, so the error must be explicit and force the modification of the security config.