devise authorization added + test