add cancan
get basic auth stuff in place