Add onSuccess callback to create, attach related models to update
Add "authed" access rule, fix facade accessor