I don't like the fact that this class handles both Publishers and Curators, since it's called `CuratorAuthorization`. I'd say either change the name, or possibly try to take advantage of the fact that you can specify multiple permission classes for an object ? (Not sure it does what we want here, but worth investigating)