devise + cancan better, but not finished yet