Minor refactor of the compilations controller.
Create action for collections now throw out requests that attempt to assign a parent that the current user doesn't have edit permissions to.
Users attempting to add files to a collection that doesn't belong to them will now be shown an error message and barred from doing so.
Merging in some quick work I did to disallow adding children to a parent that the user doesn't have edit access to.
Adds can_read? and can_edit? methods in application_controller that compilations and collections now use as filters before running certain actions.
Update the compilations controller spec to make sure that can_read?/can_edit? filters correctly halt execution of the controller action.
Moves the non trivial amount of code required to get the custom permission filters for objects working into its own clumsily named module.  Also adds a can_edit_parent? method and filter.
Give bill edit permissions on the root collection object.
Compilations don't have parents, so this removes that erroneous filter application.
Filters provided by editable objects should now raise a NoParentFoundError when an action expecting a parent param pointing at a Fedora object fail to deliver.  Collections controller leverages this behavior with a new rescue_from call and some cruft elimination on the new action.
Updates the collections factory to give us a private collection to work with, more collections controller test coverage.
Eliminates most of the bulk in the create action of the collections controller, as the filters should take care of it.
Fixes deprecation warning that render_403 was throwing.
Adds authenticate user checks to update and destroy actions, as unauthenticated users should never be doing either of these things.
Flesh out tests over the nu collections object.
Merge branch 'develop' of https://github.com/nu-lts/drs into develop

Merging in David's fix for broken collection creation.
Merge branch 'develop' into feature/better_action_filters

Merging to get collection create working again and going from there.
Rudimentary flash view.
Working collection tests.
Embargo dates shouldn't be required; removing this from the view.