Basic cancan/rolify setup, unused so far