Authorization

So I added authorization with CanCan. I think it's correct. We probably should go over it today in the meeting to make sure it is correct.