Move nil check to authorizes?

Not sure why a resource owner should be authorizing the nil case.
Doesn't make sense for our application. This commit just moves logic to
a method so overridding it is easier.