Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
Is this right? unless we're filtering the "approved" attribute on create and not update, it seems like you should actually have another method here (`approve?`) which does the check that's currently in `update?`

Not sure how much to get into this here, but what do you think?