code: function createSecure(user, options) {
      // jscs:disable
      // jshint -W040
      const self = this;
      // jshint +W040
      // jscs:enable
      let shield;
      let action;
      let rules;
  
      // validate that the model isNew
      if (!self.isNew()) {
          return Promise.reject(
              new AuthError('attempt to create a record that exists')
          );
      }
  
      // assign vars
      shield = self.constructor.shield;
      action = 'create';
      rules = shield.getApplicableRules(action);
  
      // run authorization, then perform save
      return applyRules(rules, self, user)
          .then(function executeSave() {
              return shield._save.call(self, options);
          });
  }
docs: create a new record in DB after verifying privs
  @param {object} user is the user credentials
  @param {object} options are options to be passed to save call
  @return {Promise} resolves to save result or rejects with auth error