authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
nope, it's an instance method. http://www.railstips.org/blog/archives/2009/05/11/class-and-instance-methods-in-ruby/

if it's one `Ability` class then we won't need to override `current_ability`