CanCan, with a strong_parameters work-around for Rails 4. Huzzah!