CarrierWave secure download url with CanCan for restrict permission