moving authorization check to application_controller; comparison debugging