Use active model serializers
PostSerializer
RSpec: add authorization headers to all requests