add error pages
start using cancan for authorization
simple ability model not logged in / user / admin
root_url -> locations, can read by everybody