WCMS-2 Custom profiles

This would always authorize against the `CustomProflie` rather than the `@custom_profile` instance. Since the variable it's never set at the time of authorization. It's probably best to set the variable in a `before_action` or call `authorize` form within an action.

Also `before_filter` is deprecated and it should be renamed to `before_action`.