Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
Once again, it's not clear to me that this is testing behavior specific to the UsersController, and therefore maybe shouldn't be here.