added CanCan BackendAbility | updated BackendUser specs