Other policy cleanup

* Move more policy spec assertions into shared examples
* `TaskAccessCriteria` has two methods, `authorized_to_modify_task?` and `authorized_to_create_task?` that do all the actual authorization work in any policy that includes it.  
* Avoid using `create(:paper, :with_tasks)` because it's slow.
* Avoid making a user a `:site_admin` for no reason.


Not sure if i'm in love with the description of this example but I guess it's okay. Maybe "lets them access all methods"?