Use environment variable RequestAuthentication/AuthorizationPolicy

You can already do that today. Did you run into any problem?