I decided not to make authorization requirements and handlers for each and every resource because the validation logic is pretty similar