I don't think `transfer_ownership` is better or worse than `transfer`.

The current authorizer *could* make assertions on the validity of its `record`, but does not. As such the only authorization logic implemented reads "is the current user the owner of this cookbook?"  You seem to be claiming that we have stronger guarantees that we're doing the right thing because the cookbook in question happens to be accessed through a cookbook collaborator record, but I'm not sure I see how that's a very strong guarantee.

Besides, we already have a strong guarantee that we're doing the right thing: the controller is constructed in such a way that the set of possible transfer URLs (i.e. those that don't 404) are URLs where the new owner is already a collaborator ([ref](https://github.com/opscode/supermarket/blob/transfer-cookbook-ownership/app/controllers/collaborators_controller.rb#L79-L80)).