Cancan applied, some visual tweaks, 403, 404, make admin