worked more with cancan authorization. still a little stuck