Enforcing Public/Private Access in Rails
medium.com