Loosen the paper policy

## References
* https://www.pivotaltracker.com/story/show/82119774

## Notes
The above pivotal card was rejected because when an admin added a non-admin as a task participant, the task did not show up on the non-admin's dashboard.  This was because the paper policy was too restrictive and the non-admin did not pass the `show?` policy logic.

So this pull request is being opened without tests because:  we have no idea what the proper policies should be in this case.  The change we made correctly shows the paper on the non-admin dashboard, but the non-admin would get `403`'d when trying to update the paper, for instance.  They would, however, be able to update the task that they are now a participant on.  Is it acceptable to not allow updates on the paper if they are a task participant?  What should the other policy enforcements look like in this situation?

--- AC + TS