ApplicationController#current_ability looks at current_user_info so that it works for API requests as well.