use cancan to restrict transfers
use token_confirmation on transfer model
transfer controller tests