Pundit-based user authorization

* Added pundit last version
* Added user policy (rely on single-org-per-user for now)
* Apply policies on new/create/update actions
Prefer double-quoted strings unless you need single quotes to avoid extra backslashes for escaping.