update admin permits, begin auth with ability.rb
format flash messages with bootstrap alerts