Fix #4360: Something broke random=true.

When random mode is enabled @post_set.posts returns an array, which
caused `authorize` to try to lookup the wrong policy.

This only happens when `authorize` is given an array with more than one
element, which is why it wasn't caught by the tests.

test/functional/posts_controller_test.rb

@@ -105,6 +105,13 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
           get posts_path(format: :json), params: { random: "1" }
           assert_response :success
         end
+
+        should "render with multiple posts" do
+          @posts = create_list(:post, 2)
+
+          get posts_path, params: { random: "1" }
+          assert_response :success
+        end
       end
 
       context "with the .atom format" do