[chore]set default value false to album's private
[feature]use Pundit authorization for hide_card api
[feature]authorize for Album show action