Because we want to restrict access to a resource based on request properties. This seems like the natural place to do it, though I'm open to suggestion.