change authorization for index to :read, {model} for #384