Is this newly added authorization check necessary? We know that we are providing the registration associated with the logged in user (as per the query), which implies that they have read access, does it not?