at some point we should probably put all of this access control into abilities.rb