Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
I took this method out of rack-prx_auth because I thought you said it shouldn't be there. Should I add it back in?