change api to expect a context (that has policy-finding logic), rathe than a user; correct policy-mapping bug; define some common policies, define as a Rails engine