docs: def run(self, value, errors, request):
          """Return thing, but abort validation if request.user cannot view."""
          thing = super(ViewableDBThing, self).run(value, errors, request)
          if errors:
              return None
          if not thing.can_view(request.user):
              message = 'Insufficient permissions for {0}'.format(self.param)
              raise HTTPForbidden(message)
          return thing