permissions model, cancan authorization, move generator to bracket#new