Make AuthorizeFilter (or something like it) constructable

[rynowak]

AuthorizeFilter can't really be constructed today, it needs a service, which makes it really cumbersome to use in startup code or conventions.

We should either add a new class that's constructable, or add another constructor to AuthorizeFilter.

[danroth27]

Is this needed to enable authorization in "Razor Pages"?

[rynowak]

Here's what I did to hide the ugliness: https://github.com/aspnet/RazorPages/blob/master/src/Microsoft.AspNetCore.Mvc.RazorPages/DependencyInjection/PageModelConventionBuilderExtensions.cs#L40

It's required to add Authorize as a global filter