@jnicklas I feel highly skeptical about passing user-supplied params into the policy action. Since when should you gain admin privileges by adding the magical key `admin=true` into the query string?

IMO authorization should be decided on the basis of the user and the record and their relationship.

```ruby
authorize @post, :publish?

def publish?
  user.editor?
end
```

What might be ok (and the source of discussion in #48 and #50) is passing `options` into a policy.

```ruby
authorize @post, :publish?, collaborator: true
authorize @post, :publish?, collaborator: false

def publish?(options = {})
  user.editor? || user.collaborator_on?(post.blog) if options[:collaborator]
end
```

But again, we've had lots of discussion on this issue and never seen a code example that says: I would benefit with some options being passed in. I'll reconsider anytime there is a good example, but I oppose this PR, for two reasons:

- No user-supplied magic key should IMO open your authorization layer (`...?admin=true`)
- The example is weak. If we cannot include a proper example in the Pundit specs, we should not include the feature.