basic authorization without cancan
improved relations for cancan and first tests now work