add further cancan auth permissions