force CAS-login, enforce CanCan restrictions