Add pundit gem, StoryPolicy & fake update method

Right now update method just calls "authorize resource" before showing the resource.
If the above comment on `AccountablePolicy` turns out to be correct, I don't think we end up needing this