Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
rather than stubbing any instance, you should be able to access the controller that will be used by this test with the `@controller` instance variable. you might even add a `controller` method to ActionController::TestCase which returns this ivar.