pundit gem added, policy logic moved from views to policy classes