move authorization to Ability model, and redirect in controller using `authorize_resource`