use cancan to authorize and validate single-use tokens.