auth controller needs no pundit

app/controllers/admin/auth_controller.rb

@@ -3,6 +3,10 @@ module Admin
   class AuthController < AdminController
     skip_before_action :authorize_user
 
+    # bypass pundit lockdowns for auth requests.
+    after_action :skip_policy_scope
+    after_action :skip_authorization
+
     def login
     end
 

app/controllers/admin_controller.rb

@@ -4,8 +4,8 @@ class AdminController < ApplicationController
   layout 'admin'
   before_action :authorize_user
 
-  # after_action :verify_authorized, except: :index
-  # after_action :verify_policy_scoped, only: :index
+  after_action :verify_authorized, except: :index
+  after_action :verify_policy_scoped, only: :index
 
   rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized