Add request arg for backwards compatibility
We should fully hydrate the object before we try to perform any authorization checks