bastodon/app/policies/settings_policy.rb