get rid of authorize! and rely on cancan