refactored authorize method and before_filters