Authorize endpoints with ActionPolicy, based on current_user & current_team & current_member & roles

[mediafinger]

Changes

• [x] uses the actionpolicy gem
• [x] authorize all endpoints depending on which current_team the current_user has selected
• [x] only being a member of team does not authorize
• [x] the current_user has to select one of the teams they are a member of as current_team
• [x] some actions only authorize current_members that have a required role (e.g. owner)
• [x] other actions might be free to access to any logged-in user
• [x] some actions might be free to access to anyone (guest user)
• [x] users do not belong to teams - but pictures (and most other objects) should

All the pre-work has been done. What is open now it to actually use the Policy#rules on the endpoints

• https://github.com/mediafinger/yournaling/issues/22

TODOs

• [x] authorize UsersController
• [x] authorize TeamsController
• [x] authorize MembersController
• [x] authorize PicturesController
• [x] authorize PicturesOnlyController
• [x] authorize CurrentTeamsController
• [x] authorize PagesController
• [x] authorize SessionsController (?)