If not enable_authorization\!, then ModelName.unsecured returns self.