this should be using devise and cancan