added idea for authorization

Data-based-Authorization.md

@@ -0,0 +1,14 @@
+In some settings, it may be desirable to restrict access to particular datasets to particular individuals. The identity of users is typically passed via HTTP request headers such as the Cookie or Authorization headers. We expect that the precise mechanism will vary greatly. In order to support this with maximum flexibility, we propose to add a `is_authorized(descriptor): Boolean` method to the ItemSource interface. `is_authorized` will be called prior to `CacheEntry.serve_content` to verify that the user is allowed to access the indicated path. The default implementation for the provided FileItemSource and S3ItemSource always return true; an example implementation that requires that a `meaning-of-life` Cookie containing the text `42` could look as follows:
+```
+from flask import request
+from cellxgene_gateway.gateway import item_sources, launch
+
+class AdamsFileItemSource(FileItemSource):
+  def is_authorized(descriptor: string):
+    cookie = request.cookies.get('meaning-of-life', '')
+    return cookie.find('42') != -1
+
+cellxgene_data = os.environ.get("CELLXGENE_DATA", None)
+item_sources.push(AdamsFileItemSource(cellxgene_data, "adams"))
+launch()
+```