added cancan to user model