refactor authorizations to show /users using cancan
add user controller tests