added hack to get around bug in CanCan. also fixed up some roles_mask stuff