create :permitted_by method for obtaining scoped records

- can scope by reusing other action scopes
- can write new scope
- must write new scope if using association
- uses squeel
- tested at model layer
updated readme