Added cancan access restriction

See https://github.com/ryanb/cancan