removing cancan - will use scopes for authorization