[webui] Introduce pundit as authorization system. Use it for attribs