Move sharedCtor call after auth checks

[bajtos]

Possible breaking change (only prototype methods are affected):

Any code run before "invoke:before" phase (where we initialise the instance) will not receive ctx.instance:

• "remotes.authorization" hook
• "rest.before" hooks
• custom phases inserted before "invoke" phase

Connect to #311

@ritch please review ASAP.

[bajtos]

Closing in favour of #316