refine routes, generate cancan's ability model for url auth