added cancan abilities and adjusted controller spec for user authorization