add permission checking and use cancancan
added main admin menu