use not_found template to handle not_authorized
destroy ability