bug fixed: Cancan user auth