restrict-to-owner does not allow Service.remove(null) from internal systems

[joelkoz]

In the restrict-to-owner hook, the code that allows authorization checks to be by-passed for internal system calls:

if (!hook.params.provider) { return hook; }

is currently done AFTER the check to see if a hook.id was passed in:

if (!hook.id) { throw new errors.MethodNotAllowed('The restrictToOwner hook should only be used on the 'get', 'update', 'patch' and 'remove' service methods.'); }

This prevents an internal service from calling service.remove(null) to delete the entire collection. The order of the two checks should be reversed.

[daffl]

This has been closed via #335 and released in v0.7.11.