Pundit 2.1.1 changed it so that if the first argument to `authorize` is an Array, then the `authorize` call returns the last element of the array. This broke order:random, because in that case we returned an Array of posts. The fix is to return an ActiveRecord::Relation of posts, which is more correct anyway.