Fix for #844: Authorization calls update_detail twice with different inputs

Fixes #884. Authorization for update should be only called once with a fully hydrated bundle.

If there was a valid reason for it being called twice (once in ``obj_update`` and once in ``save``), please let me know. I can't think of a practical reason.