rails 2 authorisation part 1