Authorization for controllers modeled after Pundit