Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
I'm curious, does this crash if user is nil, or is that something that is taken care of by Pundit?