implemented role based authorization system on model and controllers, next step: views