Authorize action before validating

[kjellmorten]

Right now, we do it in the opposite order, allowing actions without ident, e.g, to give validation errors instead of no access.

This applies to GET, SET, and DELETE.