load_and_authorize_resource on each controller