[This issue was in fact found on 2013-07-09 and is being filled now only for tracking purposes.]

During code inspection, I found one method in the OperationContextImpl class that is IMHO missing an authorize call: readResourceForUpdate. Compare with readModelForUpdate. See TODO in the code.