Let's expand on the use of the authorizer! Frequently the first few calls are verifying not just the token, but pulling back the user's information to verify access, etc. We can extract these calls out to the Lambda authorizer, centralizing the calls and giving us the benefit of the authorizer's 5 min cache. This simplifies our codebase as we can be confident that the headers are being set correctly upstream. Our services and databases get a breather from the frequent calls. Local development does not need any keys or secrets to run.