The point of this commit is to check the owner type so that you return the right return type (403 because the owner type is invalid). 
This is done by a validation of the owner_type attribute. 
If owner_type is wrong, 'set_default_user' will fail right away (it uses 'self.owner') and return a 500 which is what we want to avoid, as this is not an internal server error, if we get to this point (validations and such) the request is well formed, but the data inside the request might be wrong. 
Instead of doing this, as 'set_default_user' needs to be saved but it doesn't deal with any of the validations, we should defer 'set_default_user' to any stage after the validation, to ensure it gets the right data (= not a broken owner type). 

Since any failures on the owner_type will be handled during the validation, both 'after_validation' and 'before_save' are proper places to execute this method with a guarantee that it won't fail.