Update documentation showing use of can_update

Adds a simple example problem to the cookbook:
given an ArticleResource which should be read-only (i.e. only
allow "GET") and a CommentResource which has an ArticleResource
as a foreign key, how to let users set the ArticleResource foreign
key without running into authorization problems.

Fixes #480.