Add pundit (authorization check) to all controllers