rails update
supporting basic cancan authorization