add CanCan to Gemfile
raise CanCan::AccessDenied on bad token.