authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
if it's not separate abilities, then it will all be in the `Ability` class?

outside the module as in your `def current_ability` should be outside the `ClassMethods` module, `current_ability` is not a class method.