Migrate to CanCanCan role system