authorized fetch: let /@instance.actor through

this is probably never actually used, but it still looks like a good
idea (also, FireFish does it)

thanks @ShittyKoper for noticing!