Alright, I figured this one out. I needed to authorize all users to call the actions for builder and create_custom. Then I could get rid of these exceptions. I need to keep the skip_before_filter, since I am doing a post request without creating a html form for it. We do the same thing in activities_controller for milestones.