Optimize admin decorator

Now that we’ve added more entities and more authorization checks, it
makes sense to use Pundit to clean things up.