Authorization redux: replaces CanCan & Permitters with Pundit and some
simple Policy classes.

The motivation for the auth overhaul stemmed from the lack of finesse
the previous setup provided when it came to setting auth policies on
parameters on nested resources. The setup I had in place for that worked,
but it wasn't terribly clear - or at least not as obvious as what is
afforded by the new setup. The "simple OOD" approach advocated by Pundit
will scale better with the app as it grows as well (in terms of clarity
and maintainability), so it made sense to experiment with the gem
and confirm its virtues while the code base is still on the small end
of the spectrum here.