Authorization and Statelessness

Hi all,

Why doesn't authorization violate the statelessness constraint of REST? 
It seems to reduce visibility (monitoring systems need to know both the 
request datum AND the user's access rights to understand a request) and 
scalability (server needs to store access-control metadata across 
requests). What makes this different from, say, personalizing a response 
based on the client's username?

Cheers,
Shea Levy