Auth0-authorization-extension rule doesn't work as-is