Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
is it clearer if you say `AccountPolicy.new(user, account).must_be :create?` ? I don't think so.

What if we add (to `test_helper.rb`)

```ruby
Minitest::Expectations.infect_an_assertion :assert_operator, :must_allow, :reverse
Minitest::Expectations.infect_an_assertion :refute_operator, :wont_allow, :reverse
```

That would let us (I think) write tests like `AccountPolicy.new(user, account).must_allow :create?` or `AccountPolicy.new(nil, account).wont_allow :create?` - does that seem better or not worth the hassle?