title: Rails: authorizing user with CanCan gem issue
body: <p>I have an action in my controller that looks like the following:</p>
  
  <pre><code>  def show
      @user = User.find(params[:user_id])
      # ... more stuff.
    end
  </code></pre>
  
  <p>Note, I'm overriding the loading of the resource as CanCan tries to load with <code>params[:id]</code> and I need to use <code>params[:user_id]</code> here.</p>
  
  <p>The top of my controller has the following defined:</p>
  
  <pre><code>  authorize_resource :only =&gt; [:show]
  </code></pre>
  
  <p>And in Ability.rb:</p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      user ||= User.new
      can :show, User if :id == user.id
    end
  end
  </code></pre>
  
  <p>All of my invocations are unauthorized however. I'm using devise for authentication and I'm verifying that the <code>user</code> object being passed into initialize is indeed the logged in user. How do I verify that the logged in <code>user</code> is only able to view the profile for which they are requesting and no other profile?</p>