Authorization and ACL for ActiveRecord and ActionController