add authorization

copied from rails_admin