We need authentication checking; otherwise people could create objects on a zone that doesn't belong to them.