Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
looks like this should also be the same as `update?`, or am I missing something?