some refactoring on authorization for users -- move to the ability class