Hacker News Reader

Check out CanCan[1] for authorization. It's pretty simple to get started with, but provides a lot of power for controlling who can access what.

Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan.

This won't take care of the parameter whitelisting for you though.