refactor. add authorization via cancan.