declarative_authorization working... sort of.