Auth: Require circle access for story actions

With the addition of multiple circles, we need
to check if people have access for each operation
on a story.

Handle the cases where our API is already ready
for this, and note the cases where we need to
do more work.