First cut at a hand-rolled auth system

We get an Enforcer instance for an actor (usually an User instance) and a subject (usually an instance of some AR object, but it could be anything).  We then ask it if we can? perform an action.

In turn the Enforcer looks up a series of rules based on the class of the subject (e.g. an Edition might use EditionRules) - with a fall through to ObjectRules which is very pessimistic and always says no.  It then uses the rules to ask if the action can be performed.

We can then use ruby to decide if the actor can perform that action on the subject.

It's not super clear to me if this approach is good.  It's kinda like cancan or the other role/auth libraries out there, but I think it'll give us more flexibility in features (e.g. we want to get reasons for why some actions are denied).
Separate edition workflow from permission, and add full set of actions

Rules for editions have changed a bit to try to push workflow stuff (e.g. you can't force publish something that's not been submitted) back down to the models, where for better or worse, the rest of the business rules live.  We also make sure that if you can't see it (e.g. access limiting) then you can't do anything else to it.
authority_test_helper can run tests inside test:units

If we detect that Rails is defined, we produce a slightly different AuthorityTestHelper module for mixing into the auth tests and we just require the normal test_helper.  If it's not been defined we load fast_test_helper and set up some other lighter objects.

This means running the test within rake test:units won't break because of class mismatches or whatever.
A user is connected to one organisation, not many
Allow creating Editions without breaking

Also clarify some of the language in the tests re: document vs edition.
Extend editions to cover rules for FatalityNotices

This makes it feel like it could be quite easy to extend the rules for different object types and use OO to share rules.
We need a delete permission for editions
Add enforcer to admin controllers

Provide enforce_permission! that renders a 403 when the current_user doesn't have permission to perform the requested action on the supplied subject.  Also can? that doe the same check but returns true or false and is exposed as a helper method for use in views.
Use permissions to generate "New document" dropdown

Extracted to a helper method to generate the dropdown.  For now it still shows a dropdown even if the user would not be allowed to create any edition types, or can only create a single type.  Perhaps we should revisit later.
We need to cope with passing in Edition classes more robustly.
Start to use enforce_permission! in controllers

Standardise on an enforce_permissions! before_filter that interrogates the action_name to work out what action and subject to enforce_permission! of.
Add new user roles: World Writer and World Editor

NOTE: These will need to be added to sign-on-o-tr-o-n.
Add tests for what world writers and editors can do to normal editions
World writers and editors can't do anything with Fatality Notices
Added rules for WorldLocationNewsArticles

Flips the situation with world editor/writers and dept editor/writers when it comes to edition permissions.  Only world folk can do things to world location news articles and dept folk can't.  Still respects the location of the object.  GDS Editors still have full permissions.
Reduce duplication somewhat in authority_test_helper
Reduce duplication in fake classes defined in authority_test_helper
Move the generic bit of authority_test_helper to the top
Add permissions tests for worldwide priorities

They follow the same pattern as world location news articles, so we move WorldLocationNewsArticleRules to WorldEdition and make both WorldLocationNewsArticle and WorldwidePriority use this as their rule set.
Edition::LimitedAccess now understands the world location scoping

If the user is a location limited user then accessible_to and accessible_by? will respect that location limited users can't see things that aren't in their locations.