created basic roles separation using CanCan