Messing around with Pundit for authorization