add authentication to app (cancan)