I think we need to check that the publisher here is the same as the content publisher, else a POST may create content attributed to a publisher it's not permitted to