needed a policy for tokens

app/policies/token_policy.rb

@@ -0,0 +1,24 @@
+class TokenPolicy < ApplicationPolicy
+  class Scope < Scope
+    def resolve
+      if user
+        scope.where('tokens.user_id = ?', user.id)
+      else
+        where(:id => nil).where("id IS NOT ?", nil) # to just return none
+      end
+    end
+  end
+
+  def create?
+    user.present?   
+  end
+
+  def my_tokens?
+    user.present?
+  end
+
+  def destroy?
+    user.present? && record.user == user
+  end
+
+end

app/serializers/token_serializer.rb

@@ -1,9 +1,7 @@
 class TokenSerializer < ActiveModel::Serializer
-  embed :ids, include: true
   attributes :id,
              :token,
              :description,
-             :user_id,
              :created_at,
              :updated_at