Rails II - Authorization: Part II - complete