Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
Nevermind, I see the difference and I don't think it's worth further abstracting