Rails 4 authentication and authorization