Add user ability and authorization