fixed some specs
added cancan abilities for users and admins