Authorize replacing of a polymorphic has-one relationship

[valscion]

This PR picks off from #53 and adds authorization for the replacing of a polymorphic has-one relationship.

Seems like jsonapi-resources is broken and won't allow clearing of a polymorhpic has-one relationship by sending

PATCH /tags/1/relationships/taggable

{ "data": null }

The issue upstream is here: cerebris/jsonapi-resources#1081

I skipped the tests for the relationship nullification for now.

[valscion]

Ach this won't work if the associated polymorphic class changes. Or I'm not sure if it works... will ave to check that.

[valscion]

Ok I think that's it, now it should work even if the type of the associated object changes with the replace operation.