Extract authorized_posts method & make owns? admin-aware