rails 2 authorisation part 2