There are a lot of examples using the
save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue.
Is this necessary?
When updating/publishing a post, WP verifies the normal nonce, and checks permissions itself, redirecting to a 403 or 'Are you sure you want to do this?` page if something doesn't check out. As such, the hook won't even be called if a bad request was made, so why would I have to double check these things myself?