move purchase login from notes_controller to purchase_controller, create can_purchase_policy