User and roles based security for rails