Authorizing context actions where? In each function, or the controller?

I like method B as well. Maybe name it __create_user__ to match Elixir’s convention for “magic” identifiers.