adding cancan for authorization
small authorization logic implemented