rails app with authentication and authorization