Function authorize 

pub(crate) async fn authorize(
    services: &State,
    caller: &UserId,
    target: &UserId,
) -> Result

MSC4323: authorization is checked before account lookups (anti-enumeration) per spec.