Add cancan authorization for documents
Require authorization for everything
Users can't delete their account