feat: add authorization with pundit