moved before_filter authorize into applicationcontroller to lock down everything by default
converted to using stripe