Decouple Auditable from Authorizable

A new class has been introduced, PendingAuditable, which mixes Auditable and
Authorizable toggether in a cleaner way.
Add support for bulk_create_with_user