CanCan and basic authorization for group member managing