db-persisted inherited permissions with CanCan