RFC 40: Move call to the Authz methods into application layer

Created by: unknwon

This issue tracks the follow up work of improve code structure for #7754, in particular:

• https://github.com/sourcegraph/sourcegraph/pull/7754#discussion_r367744941
• https://github.com/sourcegraph/sourcegraph/pull/7754#discussion_r367748125
• https://github.com/sourcegraph/sourcegraph/pull/7754#discussion_r367750144