Use cancan to authorize controller