Fixed User#can?
Added workflow index privacy test