Better way of protecting entire admin interface with CanCan