authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
OK, I think I got your point.  But doing this all the time must be very complicated. I'll further discuss with you, now I'll remove the module.