Previously only the BUR's approver was set when a BUR was approved. Set
the approver for each alias/implication in the BUR as well.
Additionally:
* Refactor `approve!` to take a user instead of just a user id.
* Be mass-assignment permissions aware when setting approver_id.