Pundit-based user authorization

* Added pundit last version
* Added user policy (rely on single-org-per-user for now)
* Apply policies on new/create/update actions
Use the new Ruby 1.9 hash syntax.