authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
Yes, for this simple approach we don't need to define it ourself.

But look at the code in V1, when we go inside course, we will change the default ability to course_ability, thus we need our custom current_ability function.

Ref: https://github.com/CanCanCommunity/cancancan/wiki/Changing-Defaults