I think you can get away with not creating a new Membership object.  Maybe something like `can? :update, m`