authorization using cancancan

We will stick to cancancan right ? 

1. provide a current_ability required by cancancan
2. an ability class, now only handles the permission of administrator
I still don't see why there is a need to have separate abilities. In any case, it looks like a candidate for transforming a conditional to polymorphism.