rails 4 authentication and authorisation