Authorization

- cancancan setup
- readded first/last name in user. accidentally removed in previous commit