I've attached a patch that addresses the feedback so far:

1. Defines HAVE_DBUS_MESSAGE_SET_ALLOW_INTERACTIVE_AUTHORIZATION and
   uses it.
2. Renames :authenticate to :authorize for consistency.
3. Signals an error when either :timeout or :authorize are passed when
   not invoking a method.

Remaining questions:

1. I'm not sure if :authorize is quite correct either. Really, the key
part is that it allows /interactive/ authorization. I wonder if
:interactive-authorization or :interactive might be better (although
they're kind of long).
2. Am I correctly signaling the error? I just copied that code from
other parts of debusbind.c.