title: Adding authorization to routes
body: <p>I cannot seem to find a good example for this. I have for example, a <code>TicketController</code></p>
  
  <p>I define a ticket resource in my routes.rb.</p>
  
  <p>You only need to be logged in as a customer to GET a ticket, but you must be logged in as an administrator to PUT a ticket.</p>
  
  <p>I currently do this at the controller level. I have a before_action for certain controller methods that check if you are logged in as customer or admin.</p>
  
  <p>I'm wondering what the correct way to do this is. I would think ideally I could require certain authorization for specific actions on a specific resource. For example, the ticket resource GET action only needs to be logged in as a customer whereas the PUT action can only happen if you are an admin.</p>