cancan in javascript