retrieve an authenticated object with correct permissions
do not check credentials for models that do not implement permissions
Add pending test case
Allow pre/post model register hooks