authz: add QAuthZSimple object type for easy whitelist auth checks