Rails 4 authorization plugin