dry policy

PostPolicy and CommentPolicy Destroy authorization code was the same, so in ApplicationPolicy I added a private "can_moderate" method that PostPolicy and CommentPolicy classes can inherit from, making the code DRY.