Users can view and update posts

- Enable all users to view all posts
- Enable current_user to view their own posts
- Enable current_user to edit their own posts
Actually, even better here would be `Post.none`, which returns an object that behaves like `Post.where` but with no objects in it. It's perfect for null objects, and you can call `current_user.posts.where` on it, which you can't do with an array.