Implemented favoriting; made Cancan permissions explicit