user.authorized? to user