Move error logic into endpoint_class() so that other functions don't have to worry about the cls not being in the collection (a 404 will be raised if that's the case, and the rest of their code won't run anyway)
have _validate raise directly rather than making caller know to; remove direct calls to session.get() and use retrieve_resource() instead