Allow to build :user, :owner
Extract permission specs to shared_examples
Test policies
Remove testing access permission on acceptance level

Possible because:
* authorization is forces for every request
* policies are tested
Validate that authorization passes successfully for authorized user