Pushing some common behavior down controller
Drop homegrown authz for cancan