limit access by creating a authorize callback in application controller