v0.4.0

• Authorizes most operations, still excluding some relationship operations.
• Allows for a custom authorizer class, that ties together the operations with an authorization mechanism.
  • The default authorizer uses Pundit, and aims to create a sensible mapping from JSONAPI operations to Pundit default actions (show?, update? etc).
• Has jsonapi-resources dependency locked to v0.7.0. We currently rely on a lot of internal methods and deemed it likely that other versions would break.