adds cancan permissions to post view and admin area