configure cancan exception handling
set up user roles