User controller with CanCan '@authorize\!'