this is good practice on security issues?

Use this to restrict entry to views that do not want users to enter

   def new
       if (user_signed_in? &&( current_user.role == 'admin'))
        @carroceria = Carroceria.new
         render 'new'
       else
           render file: "#{Rails.root}/public/404.html", layout: false, status: 404
       end
     end

   def edit
      if (user_signed_in? &&( current_user.role == 'admin'))
         render 'new'
      else
         render file: "#{Rails.root}/public/404.html", layout: false, status: 404
      end
     end