So authorizing if someone is allowed to view an order requires that they are authenticated. So if you need authorization for a route, you would use authorize! (which will automatically call authenticate! since the current user is needed), otherwise you would use authenticate!, and if you don't need anything you can leave both out.