Only allow authorization_code for oauth/doorkeeper.
restrict access to only the show route.