add the cancan to authentication