added CanCan and some role control