apply CanCan authz to items in api
add :read Collection.is_public with test
more authz tests for Collection and Item
Merge pull request #616 from popuparchive/authz-fix

Authz fix