Seconded! Using current_user.rewards.find(...) is a good stopgap if you're not keen on going as far as using cancan.

This won't take care of the parameter whitelisting for you though.