We should still verify_authorized on :index