[Fixes#68135242] ...again...missed CanCan authorization for add'l endpoints