authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
https://github.com/CanCanCommunity/cancancan/wiki/defining-abilities#hash-of-conditions