authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
Yes, they can all be in one <code>Ability </code> class

Sorry, why <code>current_ability</code> is not a class method,  it is supposed to be a class method in the application controller, right ?