Authorizing requests in a self-hosting context