added has_many authorizations to user.rb