Initial cut at CanCan authorization