Migrate cancan with multiple roles