pundit user policy

- updated user controller and created user policy.
- depending on the user role the directory will only display the appropriate users.