Can this live up above with the other authorize calls? And what about combining the authorization check for consumer_create? I think it might make more sense for one authorize to be tied to an action instead of two.