Add authorization via cancancan