Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
I think that we should be testing the pundit authorization stuff here instead of in the controller tests above