Move validation and authorization checks to call

There's also https://github.com/Factlink/pavlov/pull/23 but that branch conflates the move with the addition of an authentication check, so we might want to merge this, and turn that into a request for the addition of the authentication check. That branch needs some documentation on why that addition is needed and how you would use it.