Document "known-good" approaches to authorization (privilege/role checking)

The ideas that I'm aware of are fairly well spelled out already in [this servant-auth issue](https://github.com/haskell-servant/servant-auth/issues/73#issuecomment-349737003) (but is in no way specific to servant-auth). It might be nice to put together a runnable example that demonstrates both approaches, with some explanations, and throw the result in a new cookbook recipe.