CLC-3194 Spreading pundit auth into the model layer