Authorization using cancan.