[challenges] Add cancan for Challenge

Commit messages describe updates