omg more CanCan fixes