More accurately model the correct authorization flow in models/ability.rb.

(I think) this is what was intended here.