Move authorization to ability.rb. Index on position. Use the rails ways instead of local vars.