update gems
add cancan for authorization