#7 Move restrict_access method to application controller