Pundit authorization

Same functionality as previously present with can_can.  Exception must still be caught for unauthorized attempt.