A batch endpoint must authorize every item, not just the first

Bulk endpoints are handy: archive 50 documents, delete 20 comments, move 100 files in one call. They are also a quiet place for authorization to slip. The trap The handler receives ids: [...], loads t