add authorization to users with Cancan