authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
Oh sorry, my careless. I've updated the code.

Though we can put everything in one ability, I think we'll still need <code>current_ability</code>  to parse arguments such as <code>instance_user</code> and <code>course_user</code>