Enforce policy refactor

* References: https://www.pivotaltracker.com/story/show/82568450

Our controllers have an anti-pattern of treating `create`s differently from other id-lookup methods when it comes to authorization. This PR standardizes how we enforce policies on these controllers.

----------------------
AC & CT