redesigned user routes + cancan for user functions