* authorize: rewrite header evaluator to use go instead of rego * cache signed jwt * re-add missing trace * address comments