change load and authorize resource to manually checking authorization

cancan has a problem with strong parameters and this is the only way it
works correctly