add cancan so that only admin: true users have access to /admin