you can be authorized and have a failure

pkg/apiserver/filters/authorization.go

@@ -40,16 +40,17 @@ func WithAuthorization(handler http.Handler, getAttribs RequestAttributeGetter,
 			return
 		}
 		authorized, reason, err := a.Authorize(attrs)
-		if err != nil {
-			internalError(w, req, err)
+		if authorized {
+			handler.ServeHTTP(w, req)
 			return
 		}
-		if !authorized {
-			glog.V(4).Infof("Forbidden: %#v, Reason: %s", req.RequestURI, reason)
-			forbidden(w, req)
+		if err != nil {
+			internalError(w, req, err)
 			return
 		}
-		handler.ServeHTTP(w, req)
+
+		glog.V(4).Infof("Forbidden: %#v, Reason: %s", req.RequestURI, reason)
+		forbidden(w, req)
 	})
 }