Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
I'm generally not in favor of the `!!` meme – if it's that you want to coerce a boolean and make that clear, you can always use the `#present?` method