continued devise w/ admin capability & added cancan, but not coded yet