add authorization with Pundit, refine routes, refactor routes.rb, controllers and tests