implement role based authorization usign a bitmask mechanism ... with cancancan