Merge pull request #24 from sdford/cancan

Cancan
authoriation user index page
fixed new item ability. hid more buttons based on ability