proof of concept for pundit ...

-got the pundit policy file working
-verified that it blocked/allowed users with correct permissions
-fixed a bug in user model where the magic strings had been poorly defined
-