Clarify AllowOwner vs AllowSelf in authorization classes.