basically @operation_approved defaults to true, and then when an error is found, #deny_because is called and sets it to false.  In this case, ok? would return nil rather than false, which does seem wrong.

I also just realized that if whenever we call ok? with the :trait op that the permission errors only get added to the trait card (which means they get totally lost).  does that seem wrong?

I think maybe we should add these tests:

1. card.ok? :create, :trait=>whatever #should work (eg automatically add :new=>{} for create)
2. card.ok? :update, :trait=>whatever # should return false (not nil) when false, and should add permission_errors to card.  (if possible, something in permission errors should in indicate that error is on the trait).