First draft of "Hand Rolling User Authorization"

@ldharmar :eyes: 
Include also that the spec lets the user who's turn it is is allowed to update the turn and not the other user. Which is what it's doing right?