The inclusion of authorization information in the DEPR seems problematic as it requires additional security measures to 
protect the DEPR itself.  EPRs generally name and describe how to access a resource, but do not provide the actual 
request parameters themselves.  A better approach might be to separate the DEPR from the credentials required to access 
it by providing a delegation interface to the DTF itself.