Move authorize() up to AbstractReadOnlyDomainResource, take out validate stuff since that will be in model annotations