adding better authorization,at  railscats #385 6:33