Do not raise runtime error unauthorized

use CanCan for access control instead