add cancan ability and refine some user form