authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
You should not contextualise your ability to the course and the instance. it should be expressed in terms of joins and attributes.