title: devise 'authorize User' results in undefined method
body: <p>I'm starting with the Rails 4.1 Pundit / Devise app from RailsApps.org and continue to get undefined method errors when 'authorize User' is called in the User controller. The user can register, log in, and edit their account info. When the Users link is clicked, the following results:</p>
  
  <blockquote>
    <p>NoMethodError in UsersController#index </p>
    
    <p>undefined method `authorize' for #</p>
  </blockquote>
  
  <p>Here is the UsersController...</p>
  
  <pre><code>class UsersController &lt; ApplicationController
  
    before_filter :authenticate_user!
    after_action :verify_authorized
  
    def index
      @users = User.all
      authorize User    # &lt;== This is the line the error occurs on
    end
  
    def show
      @user = User.find(params[:id])
      authorize @user
    end
  
    def update
      @user = User.find(params[:id])
      authorize @user
      if @user.update_attributes(secure_params)
        redirect_to users_path, :notice =&gt; "User updated."
      else
        redirect_to users_path, :alert =&gt; "Unable to update user."
      end
    end
  
    def destroy
      user = User.find(params[:id])
      authorize user
      user.destroy
      redirect_to users_path, :notice =&gt; "User deleted."
    end
  
    private
  
    def secure_params
      params.require(:user).permit(:role)
    end
  
  end
  </code></pre>
  
  <p>and the <code>ApplicationController</code>:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery with: :exception
  end
  </code></pre>
  
  <p>Any thoughts on how to resolve this? </p>
  
  <p>Thanks in advance!</p>
  
  <blockquote>
    <blockquote>
      <p>Comment: This is from the RailsApp Pundit Quickstart guide to explain <strong>authorize</strong></p>
      
      <p>The keyword authorize is a helper method that provides a shortcut to a longer statement that implements the actual authorization. We never see the full statement because we use the helper method, but if we were to use it, it would look like this:</p>
      
      <p>raise "not authorized" unless UserPolicy.new(current_user, User).index?</p>
      
      <p>The authorize helper method finds a UserPolicy class and instantiates it, passing the current_user object and either the User class or an instance of the User model, and calling an index? method to return true or false. You may wonder why we can provide either the User class (as in the index action) or the @user instance variable (as in the show action). </p>
      
      <p>Pundit looks for a policy object when authorize is called from a controller action. We already saw that Pundit will find a UserPolicy if given any of these arguments:</p>
      
      <ul>
      <li><p>authorize User – the User class</p></li>
      <li><p>authorize @user – an instance variable that is an instance of the User class</p></li>
      <li><p>authorize user – a simple variable that is an instance of the User class</p></li>
      <li><p>authorize @users – an array of User objects</p></li>
      </ul>
    </blockquote>
  </blockquote>
  
  <p>To me, it seems as if the helper method is found sometimes like in show and update but not index.</p>