Issue title: Best practices for authorizing create? based on parent object
 Issue body: (possible duplicate)

Which is correct? Or am I missing something?
### Option A:

``` rb
class LabelPolicy
...

  def create?
    label.project.user == user
  end
end

policy(Label.new(project: @project)).create?
```
### Option B:

``` rb
class ProjectPolicy
  def create_label?
    project.user == user
  end
end
...

policy(@project).create_label?
```

 Comments: 
 Comment 0: I don't know if it is a 'best practice' or not, but my personal preference is option A. I would consider option B a violation of the single responsibility principle. Also, if you start adding a lot of specialized methods like option B your are going to eventually lose the 'single source of truth' about if you can create a label.

 Comment 1: I agree with @scottjacobsen, I would go with option A if possible. There are cases where I've done something like option B, but I try to avoid it if I can.

{'source': 'GithubIssues', 'repo_name_with_owner': 'varvet/pundit', 'issue_id': 49414840, 'repo_stars': 7786.0}