implemented cancancan authorization; removed name column from cohorts table