A follow-up to #12005, in which I apparently missed that there are a bunch of other places that assume the create event is in the auth chain.