Actually check for authorization on a command

Also handing the entire message to the checker is kinda wonk. Just the user is needed.