Just to clarify - Is it actually critical? It looks like both just call super...save_with_user, so while it is a best practice to Authorize first, it looks like it should still work.