fixed cancan permissions for user edit