not this line here is actually where I think you need to put in cancan stuff.
your current setup won't block this happening ... I think when we do discussion level privacy the variable `@discussions_without_open_motion` will handle a bunch of what is rendered ... mmm

maybe we should kill those things in the controller now ... like if the user can't see the discussions, make that variable empty or non-existant