Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
Currently it crashes if user is nil. I could add in something to handle that case.