Create resources belonging to authenticated user

When an authenticated user creates a resource it should be assigned to them.

We need some kind of hook here so the API doesn't need to know about auth guts.