adds cancan permissions