And use cancan for authorization