Fixed cancan and devise authorization