brought up in #34. Currently `params.ability` is used over `options.ability` in `authorize`-hook.
brought up in #34. Currently
params.abilityis used overoptions.abilityinauthorize-hook.