I'm not usually a fan of `default_scope`. They tend to be confusing. I guess that means we have to call `authorized` or whatever we name the scope all over, but I think having the context is a huge plus. I dunno, any thoughts? I've just seen this become a huge headache later on in a bigger application.