Enforce policy refactor

#### References:
* https://www.pivotaltracker.com/story/show/82568450
* https://www.pivotaltracker.com/story/show/82567832

Our controllers have an anti-pattern of treating `create`s differently from other id-lookup methods when it comes to authorization. This PR standardizes how we enforce policies on these controllers.

----------------------
AC & CT