Refactor DRY in AuthHelper

[cgardens]

Tell us about the problem you're trying to solve

The method is the same. Essentially there is just a permission list supplier that is different. We could inject that and then reuse the rest. I think this might be helpful since it would be easy to make a change to permissioning in one API and forget to do it in the other. It's the sort of logic we don't want to get wrong.

Jared Rhizor (@jrhizor) what do you think?

[jrhizor]

The main challenge is that the types are all different since one is a client's types and the others are the model types. We could create type convertors, but that introduces other maintenance issues.

I definitely agree we should look at how we can share more of the logic between the two.