Add section about on_unauthorized_access option for use with CanCan

Based on comments in issue #2081