Again, this should switch on external authentication. It would be nice if we could share the shared validation and be explicit about what validation we do only for create or update. Looks like a bit too much copy-pasta here.