more work on authorization, update foundation-rails