set up nested resources to properly authorize through their parent resource