user's roles, authorization with pundit, user's update action and tests