Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
I took the user_id method out of rack-prx_auth. But I infer from this that it is in fact needed, so I shall add it back.