completed role architecture
add user abilities
first cancan permission works