now THAT looks like one very clean (but untested? bc testing Instagram OAuth is weird?) Authorize action in the Users Controller!