Rails II - Authorization: Part I - complete