Add authorizable using pundit

Includes an open and blocked policy that applications can extend. It may make sense to make this optional at some point.