async fn authorize(services: &State, caller: &UserId, target: &UserId) -> Result
MSC4323: authorization is checked before account lookups (anti-enumeration) per spec.