authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
yes it is complicated... and hard to do. so that's why I would do this last. when we know who does what. there are other things to do first.