Use Pundit for authorization

- Added [Pundit](https://github.com/elabs/pundit) for handling authorization.
- Refactored existing controllers to take advantage of Pundit