authorize callback for providers controller show action
separate admin and user cucumber features
some initial cancan authorization: view, update and destroy