added cancan to product, and security to downloading attachments
tests all passing
Merge branch 'owner-edit'