Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
to clarify, the `current_user` method belongs in Api::BaseController, I just want you to use the `user_id` method as opposed to ['sub']