CanCan example in README causes back action to not be authorized

[mvz]

The example in the README for using CanCan suggests the following:

      def masquerade_authorize!
        authorize!(:masquerade, User)
      end

However, the masquerade_authorize! method is also called before the back action. In that case, however, the current user is the unprivileged user, so reverting the masquerade is denied.

[mvz]

It looks like the Pundit example gives a possible solution:

      def masquerade_authorize!
        authorize!(:masquerade, User) unless params[:action] == 'back'
      end