no unauthorized error thrown if resource id is invalid

[m4v15]

if the resource Id in the URL is invalid it now gets thrown here (when the trying to access the resource to identify the owner) so it doesn't throw an unauthorised error, even if the user is unauthorised (as this happens before it is certain if the user is authed or not).

I actually guess that's not a problem, but it just made rewriting the tests confusing for a bit so just wanted to flag it up.

We may also now have some unnecessary error messages/uses of them in the controllers.