use pundit instead of our guard system in controllers

Pundit is a clean class based permission system instead of the modul based one we currently use. That will make tests a LOT easier.

good preperation for #113 (closed)