Allow department_editors certain edit rights.

This covers the ability to edit the department and the things closely related to it.
Another commit will cover the ability to edit certain aspects of the members of the department.

WCMS-300
Only `update` was getting `@membership` set in advance. So the authorization for all the other actions was just authorizing against the `Membership` class instead of the actual instance. But I needed the data from the instance in the policy.

It seemed easier to just do `authorize @membership` inline than to have multiple additional before filters for setting `@membership` for every action.