use cancan for authorization
fix conflict