[#2037] Fix `resource_create` authorization

Defer to `package_update` instead of `package_create`