title: User Authorization with CanCan:  NoMethodError
body: <p>Im using CanCan for authorization in my app. I currently have all of each users information stored at /users/2 or users/3 or /users/4 and so on. </p>
  
  <p>My problem is that when a user logs in they can just amend the URL and see other users sensitive content. How can I use CanCan to prevent a user (say users/2) from seeing (users/3) ?</p>
  
  <p>When I add "load_and_authorize_resource" to my users controller I get the following error:</p>
  
  <pre><code>NoMethodError in UsersController#show
  
  undefined method `user_id' for #&lt;User:0x007fee61e90b90&gt;
  </code></pre>
  
  <p>Models</p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      user ||= User.new # guest user (not logged in)
      if user.has_role? :admin
        can :manage, :all
        can :access, :rails_admin
        can :dashboard 
      else
        can :manage, User, :user_id =&gt; user.id
      end
  </code></pre>
  
  <p>Controllers</p>
  
  <pre><code>  class ApplicationController &lt; ActionController::Base
        protect_from_forgery
  
        rescue_from CanCan::AccessDenied do |exception|
          redirect_to root_path, :alert =&gt; exception.message
        end
  
  
  class UsersController &lt; ApplicationController
    before_filter :authenticate_user!
    load_and_authorize_resource
  
     def show
      @user = User.find(params[:id])
      @date = params[:month] ? Date.parse("#{params[:month]}-01") : Date.today
      @occasions = @user.occasions.page(params[:page]).per(5)
    end
  </code></pre>