devise working, cancancan not