Controller should tell the model to unauthorize, not itself.