working authorization with pundit gem