added cancan authorization; worked ui