rescue from cancan::access_denied