cancan works and wont let anyone do anything