Upgraded to CanCanCan in order to remove set_and_authorize