add event api
install cancan
handle unauthrized user
rescue from AccessDenied