security concern: singleton nature is not documented.

[markstos]

In my testing, if two projects are both loaded and use the authorized module, the state is shared between the two projects.

So if one project defines an edit user action and a second project defines an edit user action, the second would overwrite the first.

At a minimum, the documentation should disclaim the singleton behavior and note that it's only intended to be used by project at a time.