added authorization via Pundit gem