refactoring using cancancan helper, closed #7