authorization functionality with roles miplemented, before adding pundit gem for using policies