Secure journal creation

https://www.pivotaltracker.com/story/show/83870580
and
https://www.pivotaltracker.com/story/show/83870456
Looking at the build failure, I found this:

```
2) Admin::JournalsController#create when the user has insufficient permissions renders status 401
     Failure/Error: expect(response.status).to eq 401
       
       expected: 401
            got: 403
       
       (compared using ==)
     # ./spec/controllers/admin/journals_controller_spec.rb:33:in `block (4 levels) in <top (required)>'
```