wip: sketch out delegation of CRUD authorization

from the VolunteerOpsController to the User model