refs #18 authorize Role params[:id] by session[:tmp_id] and current_user's company