authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
then the ability is no longer applicable to all courses. It's possible then that the ability class allows information leakage beyond the current course.