update controller to use CanCan