Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
You took the user_id method out of rack-prx_auth? Or you took the current_user method out?