fixed cancan ability rb and now authorizing user controller