use $user->can() to check access