Add authorization with Pundit