user.id not user
cancan setup done