Remove authenticate_user filter in post and subscription controllers, move logic to ability.rb