this is a more significant functional change.  permission checking is moved out of rails validation and into wagn approve event.  still lots to be done here...