R3 role requirement bug; replace with can-can/ability