correct cancan roles
Merge pull request #19 from cherylc/update-authorization

correct cancan roles