Since jsonapi-resources v0.9.6 it has been possible to do updates to polymorphic has_many associations: cerebris/jsonapi-resources#1217
We should probably have some sort of a test to verify jsonapi-authorization works for these cases.
Would be nice if this new test case was written in a way where all the code needed for the test would be next to the test file itself, as described in #124 (comment)