Make pundit methods non-public

Pundit methods should not be public as public methods show up as controller actions, which they are not.