authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
But even if it's not separate abilities, we also need a custom function for different conditions

sorry, I don't quite understand "outside the module" ?   I put in class method because it's will automatically get extended