Fix collection/media object relationships; still needs tests
Add policy aware enforcement to controllers