fixing authorization via cancan