added rspec
added permissions back in and added cancan authentication