This allows anyone with an access to API (eg. any non-anonymous user with REST configured to use session auth) to create ContentType draft.

UnauthorizedException should be defined and implemented when user does not have access to create content type (class/create).