refactored authorizations and moved to user.rb