The problem is we can't use the before_filter, as it was done here. Instead, we need to override the authorize method in the controller, and having the module for that, directly explaining why, seems to me more explicit than doing that in every controller that needs to do that