switched to pundit for attribute authentication