added if user_signed_in? to views, tested cancan in browser