spree/spree — pull request #1487 by steveh (2012-05-04 04:30:58+00:00)
Title: Authorize instance

Per https://github.com/ryanb/cancan/wiki/Checking-Abilities :

Important: If a block or hash of conditions exist they will be ignored when checking on a class, and it will return true

I don't think this a security hole in default Spree installations, as the only times classes are used instead of objects is for new orders and new users, which (by default) can be created by anyone.

I only ran into this when I tried denying anonymous users the ability to create orders.