Move the 'get' authz check up to right after dereference step
Take out some indenting