cancan removed from api_controller and controller template