added authorization to update() in posts_controller