install cancan and secure application
finish user authorization. still need to handle access denied exceptions