add cancancan gem for authorization
set authorizations on User and Project based on ownership and guest user