CanCan auth, associate role with user