CanCan is generating wrong SQL for authorization query; do it by hand