[Andrew]

Authorization is handled completely outside the scope of the client applications. That is, we aren't doing any validation - any validation is in Apple's code.