Authorization Policies and Data Protection with IdentityServer4 in ASP.NET Core