Correctly delegate verification of the caller to the UpdateAPIGuard; don't duplicate work.