Add 'posts belong to user'; require authorization for new, edit, destroy