Shouldn't this use find_by_name so authz etc. is applied and for DRY?