Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
Avoid using {...} for multi-line blocks.<br>Block body expression is on the same line as the block start.