adding cancan for authorization, refining associations