Secure app with user permissions; add specs to confirm permissions are configured correctly

generates errors, Pundit::NotDefinedError: unable to find policy NilClassPolicy if authorize @app is at the top