refactored and cancan added
changed like from comment to post