Authorization for DESTROY and UNRESERVE is not symmetrical.

For the UNRESERVE case, if the principal was not set, .has_principal() will be false, hence we will not call authorizations.push_back(), and hence we will not create an authz request with this resource as an object. For the DESTROY case, if the principal was not set, a default value "" for string will be used and hence we will create an authz request with this resource as an object.

We definitely need to make the behaviour consistent. I'm not sure which approach is correct.