how do you implement any sort of nontrivial authorization scheme w&#x2F;out middle tier? how can you share any code between different UI platforms? I also don&#x27;t like exposing data layer directly to the client. *or worse yet storing business logic in the data layer