(G) devise as dev dependency
make engine aware of app's cancan/devise setup without breaking rspec

This might be a complete hack - I tried working with forem as an example, but I don't completely understand what they're doing.

The ApplicationController inherits from the parent app.
content_block_user needs to be (manually, for now) added to the parent app's ApplicationController.
The authorize_resource line includes the class.