title: cancancan authorize_resource not working as expected
body: <p>I am getting an unexpected behaviour for a simple cancancan authorization.</p>
  
  <p>ability.rb</p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      # Define abilities for the passed in user here. For example:
      #
      user ||= User.new # guest user (not logged in)
      if user.is_admin?
          can :manage, :all
      elsif user.is_standard?
          can :manage, ServiceOrder, {user_id: user.id}
          can :manage, ServiceOrderDetail, :service_order =&gt; { :user_id =&gt; user.id }
      end
  </code></pre>
  
  <p>service_order.rb controller (partially shown)</p>
  
  <pre><code>class ServiceOrdersController &lt; ApplicationController
    authorize_resource
  
    def show
      @service_order = ServiceOrder.includes(:service_order_details).find(params[:id])
    end
  
  end
  </code></pre>
  
  <p>This does not work, as it lets the controller show ANY service_order record, instead of just those owned by the current_user.</p>
  
  <p>The only way that this works is if I manually authorize the controller adding:</p>
  
  <pre><code>authorize! :show, @service_order
  </code></pre>
  
  <p>like this:</p>
  
  <pre><code>  def show
      @service_order = ServiceOrder.includes(:service_order_details).find(params[:id])
      authorize! :show, @service_order
    end
  </code></pre>
  
  <p>which makes no sense since <code>authorize_resource</code> is supposed to be doing that.</p>