finish production tweaks
email controller protected, but not authorized
cancan for email controller