authorisation using pundit and playing around with users and permissions/roles