Authorizing subscriptions

I've got a `foobarUpdated` subscription, but I need to authorize the users who subscribe to it as well as validate the variable (if the given id is not a valid foobar id, subscription doesn't make sense).

Is there a way to deny/cancel a subscription? I'm using `withFilter` but that only works for filtering after the subscription has been initiated.

The issue names no files or tests. Start by tracing the subscription entry point and the withFilter behavior; determine where authorization and variable validation are handled before initiation. Done means the supported behavior for rejecting unauthorized users or invalid foobar IDs is defined and covered by tests.

Written by the indexing model from the issue text.