authorize! for update

just realize calling model.update after authorize! is wrong!

the right way is to run an authorize!, then model.assign_attributes, then rerun authorize! again, 

and finally model.save