title: Rails 3.2 - Access denied exception for custom action in CanCan - but only in production
body: <p>I'm using Ruby (1.9) on Rails (3.2.13), with devise and cancan for authentication and authorization. I've a custom action in a controller that works with <em>anonymous</em> users properly in development environment. When I deployed it in Heroku, the same page threw a 'not authorized' error. I set RAILS_ENV=production locally and I got the same error. But when I set RAILS_ENV back to development, it starts working fine.</p>
  
  <p>I don't see any configuration that is environment specific for CanCan. From the docs and examples, it doesn't look like I need anything more to make this work.  Can someone please help? Here's the code:</p>
  
  <p><strong>config/routes.rb</strong></p>
  
  <pre><code>...
  resources :venues do
      ...
      ...
      collection do
        get 'testaction'
      end
  ...
  </code></pre>
  
  <p><strong>models/ability.rb</strong></p>
  
  <pre><code>class Ability
    include CanCan::Ability
    def initialize(user)
      user ||= User.new # guest user
      if user.role? :admin
          can :manage, :all
      else
          can :testaction, Venue
      end
    end
  end
  </code></pre>
  
  <p><strong>controllers/venues_controller.rb</strong></p>
  
  <pre><code>class VenuesController &lt; ApplicationController
      before_filter :authenticate_user!, :except =&gt; [:testaction] #tried with &amp; w/o this line
      load_and_authorize_resource
  
      def testaction
          respond_to do |format|
              format.html
          end 
      end
      ...
      ...
  end
  </code></pre>
  
  <p>I also tried adding a custom action under <code>members</code> instead of <code>collections</code> in routes, but the behaviour is the same.</p>
  
  <p>Thanks!</p>