improve stub_authorization! for controller specs

Previous implementation didn't work with accessible_by. This now creates
a (possibly custom) ability which is stubbed out in the controller.
fix promotions spec