Profile based authorization for ruby [on rails]