updated User controller and policy for Pundit example