This is hard to grok. First of all, any sort of authorization like this should be blacklisted for exceptions, not whitelisted. Otherwise if you accidentally leave one off you've got a vulnerability. Second, I would just have a `authorize_moderator` method that does the check and redirects if they are not authorized. Then you don't need this janky `unless`.