You should not check user_signed_in? here.  That should be handled by the Ability class.  It should declare "You must be a signed in user to update".