Rails authorization from scratch based upon Railscast #250