add phone_number to customers, allow customers.type column, add seeds for customers
do authorization on a controller level, not on an action level!