implement authorization: add admin attribute to users, add cacancan authorization